Today the Australian Strategic Policy Institute (ASPI) National Cyber Policy Centre has released a policy brief proposing a new model for cyber information sharing in Australia.

Cyber information sharing: lessons for Australia, by the Centre's principal analyst Liam Nevill, draws on the examples, issues and recommendations discussed in the forthcoming MITRE Corporation report Building a national cyber information sharing ecosystem.

The US has been pursuing cyber information sharing since the late 1990s and, according to Nevill, this long experience with a variety of information sharing models provides case studies and lessons for the Australian cybersecurity community as it pursues deeper information sharing mechanisms.

“Current approaches to information sharing in Australia have not delivered a trusted and valuable sharing ecosystem”

The results of this month’s Australian Cyber Security Centre survey showed that Australian companies see little value in sharing cyber security threat information with government or industry peers, indicating that current approaches to information sharing in Australia have not delivered a trusted and valuable sharing ecosystem.

In order to achieve a multilayered, national cyber information sharing network, the brief's recomendations for Australian governments at the federal, state and local levels, and private sector and academic partners are as follows:

Develop a collaborative strategic plan and roadmap for the national ecosystem overall, and tailored plans for each Joint Cyber Security Centre (JCSC) and sectoral information sharing organisations to meet their specific needs and environment.
Focus on building a trusted network with consideration for the establishment of a not-for-profit, trusted and independent third-party cyber information clearing house to be the hub of the national network.
While participating fully, Government should not seek overall leadership but instead provide necessary seed funding and policy and regulatory changes to support private sector engagement; private sector leadership of the JCSCs and sectoral organisations should be prioritised to generate a stronger sense of private sector ownership and commitment.
The national information sharing network needs to adapt to threats and share information that is actionable by all parties. Government should continue to optimise its processes to ensure that classified, high-value and actionable information is efficiently fed into the national unclassified sharing network.
Have a realistic financial plan for each JCSC and sectoral organisation as start-up costs are likely to be too high to be covered by membership fees alone.